Privacy Policy

Introduction

Bossku ("we", "us", "our", "the Operator") operates the online casino and sports betting platform accessible at bossku.cam (the "Platform"). This Privacy Policy sets out the basis on which any personal data we collect from you, or that you provide to us, will be processed by us.

We are committed to protecting the privacy and personal data of all individuals who interact with the Bossku Platform — whether as registered players, prospective users browsing our site, or individuals who contact us for support. This Policy applies to all personal data collected through the Platform, including data collected during account registration, the KYC verification process, payment transactions, gameplay activity, and customer support interactions.

By using the Platform or creating an Account, you acknowledge that you have read and understood this Privacy Policy and consent to the collection and use of your personal data as described herein. If you do not agree with the practices described in this Policy, please discontinue use of the Platform.

This Privacy Policy should be read in conjunction with our Terms and Conditions, which govern your use of the Platform generally, and our Responsible Gambling Policy.

Definitions

For the purposes of this Privacy Policy, the following terms carry the meanings set out below:

• "Personal Data" — any information relating to an identified or identifiable natural person ("Data Subject"), including names, identification numbers, location data, online identifiers, or factors specific to the physical, economic, or social identity of that person.
• "Processing" — any operation or set of operations performed on Personal Data, whether or not by automated means, including collection, recording, organisation, storage, adaptation, retrieval, use, disclosure, erasure, or destruction.
• "Data Controller" — the Operator, who determines the purposes and means of processing Personal Data collected through the Platform.
• "Data Processor" — any third party that processes Personal Data on behalf of the Data Controller pursuant to a written agreement.
• "KYC" — Know Your Customer; the identity verification process required before processing withdrawals or as otherwise requested by the Operator.
• "Cookies" — small text files placed on your device by a website to store preferences, session information, and analytics data.
• "Platform" — the Bossku website at bossku.cam, all associated subdomains, mobile interfaces, and any applications operated by the Operator.

Personal Data We Collect

The categories of personal data that Bossku may collect about you are set out in the table below. We collect only what is necessary for the specific purposes identified.

How We Collect Personal Data

We collect personal data through the following channels and mechanisms:

• When you complete the account registration form on the Platform;
• When you submit identity and address documents as part of the KYC verification process;
• When you make a deposit or withdrawal and provide payment method details;
• When you contact our support team via live chat, email, or any other communication channel;
• When you update your account profile or adjust your account settings;
• When you submit a responsible gambling request such as a self-exclusion application or deposit limit change.

• Technical data (IP address, device identifiers, browser type) is collected automatically when you access the Platform;
• Usage data is collected via server logs and analytics tools as you navigate and interact with the Platform;
• Cookies and similar tracking technologies collect session and preference data as described in Section 10 of this Policy.

• Identity verification data may be cross-referenced against third-party identity verification services and sanctions screening databases as part of KYC and AML compliance processes;
• Payment processors and e-wallet providers (including Touch 'n Go eWallet, GrabPay, FPX, and DuitNow operators) may provide transaction confirmation data to the Operator;
• Fraud prevention and risk scoring services may provide supplementary data signals to assist in account security assessments.

Data Processing & Legal Basis

The Operator processes your personal data only where a valid legal basis exists under applicable data protection law. The legal bases on which Bossku relies are as follows:

1. Performance of a Contract: Processing is necessary to provide you with the services you have requested — including account creation, game access, payment processing, and customer support. Without this processing, we cannot fulfil our contractual obligations to you.
2. Compliance with a Legal Obligation: Certain processing activities — including KYC identity verification, transaction monitoring, and the maintenance of records for anti-money laundering (AML) purposes — are required by applicable laws and regulations. We have no discretion to perform these processes differently.
3. Legitimate Interests: We process certain data on the basis of our legitimate interests in operating a secure, fraud-free gaming platform, improving our services, and protecting the integrity of the Platform — provided those interests are not overridden by your rights and freedoms.
4. Consent: Where we process your data for purposes that are not strictly necessary for the provision of our services — such as sending you promotional communications, applying optional analytics tracking, or processing a self-exclusion request that involves disclosure of health-related data — we rely on your explicit consent, which you may withdraw at any time.

How We Use Your Personal Data

Bossku uses the personal data we collect for the following purposes:

• Creating, maintaining, and administering your Account;
• Authenticating your identity when you log in to the Platform;
• Processing deposits and withdrawals in MYR via your chosen payment method;
• Delivering game content, sports odds, and live dealer services to your device;
• Managing VIP programme membership, bonus eligibility, and promotional offers;
• Providing customer support and responding to your queries and complaints.

• Verifying your identity and age (you must be 21 or older) in compliance with our KYC obligations;
• Monitoring transactions for suspicious activity in accordance with anti-money laundering requirements;
• Detecting and preventing fraud, collusion, bonus abuse, and other prohibited conduct;
• Maintaining records required by applicable regulatory and licensing frameworks;
• Responding to lawful requests from regulatory authorities, law enforcement, or courts.

• Monitoring gambling patterns to identify potential indicators of problem gambling behaviour;
• Administering self-exclusion requests, deposit limits, and cooling-off periods;
• Contacting you if our responsible gambling systems flag unusual activity on your Account.

• Analysing aggregated usage data to improve the design, functionality, and performance of the Platform;
• Conducting internal research and reporting on player preferences, game popularity, and service quality;
• Testing new features and services in a controlled manner.

• Sending you promotional offers, bonus notifications, and news about new games or features where you have consented to receive such communications;
• Personalising promotional content based on your gameplay history and preferences;
• You may withdraw consent for marketing communications at any time by contacting support or updating your Account preferences.

Data Sharing & Disclosure

Bossku does not sell, rent, or otherwise trade your personal data to third parties. We share personal data only in the following limited and controlled circumstances:

We engage trusted third-party service providers to assist in delivering our services. These providers act as Data Processors under written agreements that require them to process your data only on our instructions and in accordance with this Policy. Categories of service providers include:

• Payment processors and e-wallet operators (including providers facilitating DuitNow, FPX, Touch 'n Go eWallet, and bank transfer services);
• Identity verification and KYC service providers;
• Cloud infrastructure and hosting providers;
• Fraud detection and risk management platforms;
• Customer support software providers;
• Analytics and Platform optimisation tools.

The Operator may disclose personal data to regulatory authorities, licensing bodies, law enforcement agencies, or courts where required to do so by applicable law, court order, or regulatory direction. Such disclosures are made only to the extent strictly necessary and will be documented accordingly.

In the event of a merger, acquisition, restructuring, or sale of all or part of the Operator's business, personal data held by the Operator may be transferred to the relevant successor entity. Where such a transfer occurs, you will be notified and the successor entity will be bound by privacy obligations no less protective than those in this Policy.

Data Retention

Bossku retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, including any applicable legal, regulatory, accounting, or reporting requirements. The general retention periods applicable to different categories of personal data are as follows:

• Account and Identity Data: Retained for the duration of your Account plus a minimum of five (5) years following permanent Account closure, in compliance with AML record-keeping obligations.
• KYC Documents: Retained for a minimum of five (5) years from the date of submission or Account closure, whichever is later, in accordance with applicable compliance frameworks.
• Financial Transaction Records: Retained for a minimum of seven (7) years from the date of each transaction, in compliance with financial reporting and AML requirements.
• Technical and Usage Data: Retained for up to twenty-four (24) months from collection, after which data is aggregated or anonymised for analytical purposes.
• Customer Support Records: Retained for three (3) years from the date of each interaction, to support dispute resolution and service quality monitoring.
• Marketing Consent Records: Retained until you withdraw consent and for a further two (2) years thereafter to evidence the history of consent management.

Following the expiry of applicable retention periods, personal data is securely deleted or anonymised in accordance with our internal data disposal procedures.

Data Security

Bossku implements comprehensive technical and organisational security measures designed to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. Our security infrastructure includes, but is not limited to:

• 256-bit SSL/TLS encryption for all data in transit between your device and our servers;
• AES-256 encryption for sensitive data fields stored in our databases;
• Two-factor authentication (2FA) available for all player accounts;
• Role-based access controls ensuring internal staff access only the data necessary for their specific job functions;
• Comprehensive audit logging of all access to personal data by internal personnel;
• Regular penetration testing and vulnerability assessments of the Platform and underlying infrastructure;
• Incident response and data breach notification procedures maintained and tested regularly.

While we employ industry-standard security measures, no method of data transmission over the internet or electronic storage is completely secure. You also play a role in keeping your data safe — use a strong, unique password for your Bossku account, enable 2FA, and never share your login credentials with anyone.

Cookies & Tracking Technologies

The Bossku Platform uses cookies and similar tracking technologies to provide core functionality, improve user experience, and collect analytics data. The types of cookies we use are described below:

These cookies are essential for the Platform to function correctly. They enable core features such as account authentication, session management, security token validation, and fraud prevention. These cookies cannot be disabled without significantly impairing your ability to use the Platform.

Functional cookies remember your preferences — such as your preferred language, display settings, and last-visited game categories — to provide a more personalised experience. Disabling these cookies may result in a degraded user experience but will not prevent basic Platform access.

We use analytics tools to collect anonymised or pseudonymised data about how visitors interact with the Platform — including pages viewed, time spent, navigation paths, and device types. This data helps us identify performance issues and improve the Platform. Analytics cookies are only placed with your consent.

You may manage cookie preferences through your browser settings. Most modern browsers allow you to view, block, or delete cookies. Please note that blocking strictly necessary cookies may prevent you from logging in or using core Platform features. Detailed instructions for managing cookies are available in the help documentation of all major browsers.

Your Data Rights

Subject to applicable data protection law, you have the following rights in relation to your personal data held by Bossku. To exercise any of these rights, please contact our support team at [email protected]. We will respond to all legitimate requests within thirty (30) calendar days.

Minors & Age Restriction

The Bossku Platform is strictly intended for individuals aged 21 years and above. We do not knowingly collect, process, or retain personal data relating to persons under the age of 21.

If we become aware — through our KYC verification process, responsible gambling monitoring, or any other means — that personal data has been submitted by a person under the age of 21, we will immediately suspend the associated Account, notify the individual, and securely delete their data to the extent not required to be retained for regulatory purposes.

International Data Transfers

As a platform serving Malaysian players through an internationally operated service infrastructure, some of the personal data we collect may be transferred to and processed in countries outside of Malaysia. This may occur, for example, where we use cloud hosting services, identity verification providers, or analytics platforms whose infrastructure is based in other jurisdictions.

Where such transfers occur, Bossku ensures that appropriate safeguards are in place to protect your personal data to a standard equivalent to that required under applicable Malaysian data protection law. Such safeguards may include contractual clauses requiring recipients to protect personal data, or transfers to jurisdictions with recognised adequate data protection standards.

If you would like further information about the specific safeguards in place for any particular international transfer of your personal data, please contact us at [email protected].

Amendments to This Policy

Bossku reserves the right to update or amend this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or the structure of the Platform. Where amendments are material, we will notify registered users via the email address associated with their Account and/or by a prominent notice on the Platform at least seven (7) days before the amended Policy takes effect.

Your continued use of the Platform after any amendment takes effect constitutes acceptance of the revised Privacy Policy. If you do not accept the amended Policy, please cease using the Platform and contact us to arrange Account closure and return of any remaining real-money balance.

The current version of this Privacy Policy is always available on this page at bossku.cam/privacy-policy. The "Effective Date" and "Last Updated" date at the top of this document will always reflect the most recently applicable version.

Contact Us

If you have any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data, please contact the Bossku Data Protection team through any of the following channels: